A Secure Priority Queue; Or: On Secure Datastructures from Multiparty Computation

Abstract

Secure multiparty computation (MPC) – computation on distributed, private inputs – has been studied for thirty years. This includes “one shot” applications as well as reactive tasks, where the exact computation is not known in advance. We extend this line of work by exploring efficient datastructures based on MPC primitives. The oblivious RAM (ORAM) provides a completeness theorem. However, implementing the ORAM-CPU using MPC-primitives is costly; current IT-secure constructions incur a poly-log overhead on computation and memory, while computationally secure constructions require MPC-evaluation of one-way functions, which introduces considerable overhead. Using ideas radically different from those in ORAM’s, we propose a secure priority queue. Data accesses are deterministic, whereas ORAM’s hide the access pattern through randomization. $n$ priority queue operations – insertion and deletion of the minimal element – require $O(n\log ^2 n)$ invocations of the cryptographic primitives in $O(n)$ rounds. The amortized cost of each operation is low, thus demonstrating feasibility.

Supported by the Danish Council for Independent Research via DFF Starting Grant 10-081612. Additional support from the Danish National Research Foundation and The National Science Foundation of China (under grant 61061130540) for the Sino-Danish Center for the Theory of Interactive Computation.

A An ABB Realization

Consider a passive adversary and Shamir’s secret sharing scheme over $\mathbb {Z}_{M}= \mathbb {F}_M$ for prime $M$, [Sha79]. Secret sharing allows one party to store a value privately and robustly among multiple others. If and only if sufficiently many agree, the value will be revealed. Input (respectively output) simply refers to secret sharing a value (respectively reconstructing a secret shared value). To implement arithmetic, note that Shamir’s scheme is linear, so addition is simply addition of shares, while secure multiplication can be obtained through the protocols of Ben-Or et al. when less than $N/2$ parties are corrupt [BGW88]. It can be shown (given secure communication between all pairs of players, and assuming that all parties agree on the secure computation being performed) that these protocols realize $\mathcal {F}_\mathtt{ABB }$ with perfect security in the presence of passive adversaries. Further, the protocols of [BGW88] even realize (a variation of) the presented $\mathcal {F}_\mathtt{ABB }$ in the presence of active adversaries if the corruption threshold is reduced to $N/3$ – this solution guarantees termination.